CSS CSS Security Investigations & Reporting 1 — Questions and Answers
Question 1: What is the most important characteristic of a well-written security incident report?
- It contains the officer's personal opinions and theories about who is responsible
- It is accurate, factual, objective, complete, and written in clear language (Correct answer)
- It is as brief as possible with minimal detail
- It is written several days after the incident while memories are clearer
Correct answer: It is accurate, factual, objective, complete, and written in clear language
Security reports must be factual, objective, and complete because they may be used as legal documents in investigations or litigation.
Question 2: Which of the following best describes the chain of custody in a security investigation?
- The chain of command for security officer supervision
- A documented record of who collected, handled, and transferred evidence to ensure its integrity (Correct answer)
- The order in which witnesses are interviewed
- The sequence of alarm responses by officers
Correct answer: A documented record of who collected, handled, and transferred evidence to ensure its integrity
Chain of custody documents every person who handled evidence, ensuring it was not tampered with and is admissible in legal proceedings.
Question 3: When collecting evidence at a scene, a security officer should:
- Handle evidence with bare hands to examine it more closely
- Photograph the scene before touching anything and use gloves or tools when collecting physical evidence (Correct answer)
- Remove all evidence immediately to secure storage
- Allow bystanders to observe and photograph the evidence
Correct answer: Photograph the scene before touching anything and use gloves or tools when collecting physical evidence
Photographing the scene before collection and using proper handling precautions preserves evidence integrity and chain of custody.
Question 4: A security supervisor is investigating an allegation of employee theft. Which is the most appropriate first step?
- Publicly accuse the employee in a staff meeting
- Review available evidence such as access logs and CCTV footage before interviewing the employee (Correct answer)
- Terminate the employee based on the allegation alone
- Report directly to media before completing the investigation
Correct answer: Review available evidence such as access logs and CCTV footage before interviewing the employee
Gathering objective evidence before conducting interviews prevents premature conclusions and protects both the investigation and the subject's rights.
Question 5: The five Ws that should be answered in every security incident report are:
- Watch, Wait, Walk, Warn, Write
- Who, What, When, Where, Why (and How) (Correct answer)
- Witness, Warrant, Weapon, Weather, Wound
- Warning, Watch, Work, Write, Withdraw
Correct answer: Who, What, When, Where, Why (and How)
Complete incident reports answer Who, What, When, Where, Why, and How to ensure all essential facts are documented.
Question 6: Why should a security officer avoid using jargon or abbreviations in a formal incident report?
- Reports are only read by officers who understand security terminology
- Jargon and abbreviations may be misunderstood by investigators, attorneys, or courts who read the report (Correct answer)
- Formal reports require technical language to appear professional
- Abbreviations save space and make reports shorter
Correct answer: Jargon and abbreviations may be misunderstood by investigators, attorneys, or courts who read the report
Security reports may be reviewed by people outside the security field; clear, plain language ensures accurate interpretation by all readers.
CSS CSS Security Investigations & Reporting 1
What is the most important characteristic of a well-written security incident report?